CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
baseThe web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (2005)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-38000US | medium6.1OT critical | KEV | ||
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a cr… | ||||
| CVE-2012-0518US | medium4.7OT critical | KEV | ||
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown v… | ||||
| CVE-2017-1000117US | high8.8 | Exploit | ||
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine… | ||||
| CVE-2025-4123US | medium6.1 | Exploit | ||
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website tha… | ||||
| CVE-2018-11784US | medium4.3 | Exploit | ||
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the… | ||||
| CVE-2019-10098US | medium6.1 | Exploit | ||
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to a… | ||||
| CVE-2019-7274US | critical9.8 | Exploit | ||
Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root. | ||||
| CVE-2021-22881US | medium6.1 | — | ||
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "… | ||||
| CVE-2020-10770US | medium5.3 | Exploit | ||
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacke… | ||||
| CVE-2008-2281US | high9.3 | Exploit | ||
Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject arbitrary web script… | ||||
| CVE-2022-45402US | medium6.1 | — | ||
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. | ||||
| CVE-2021-46378US | high7.5 | Exploit | ||
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download. | ||||
| CVE-2016-5385US | high8.1 | — | ||
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in… | ||||
| CVE-2020-8143US | medium6.1 | — | ||
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a s… | ||||
| CVE-2021-22873US | medium6.1 | — | ||
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had pr… | ||||
| CVE-2021-28125US | medium6.1 | — | ||
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener funct… | ||||
| CVE-2025-25198US | high8.8 | Exploit | ||
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker… | ||||
| CVE-2023-33405US | medium6.1 | Exploit | ||
Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. | ||||
| CVE-2021-46366US | high8.8 | Exploit | ||
An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute… | ||||
| CVE-2024-35133US | high8.2 | Exploit | ||
IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan